On iOS, all apps must go through the App Store. On macOS, the Mac App Store is just one method of distribution and developers are free to publish their apps independently on their own website. This means app rejection policies on macOS are not as painful as with iPhone or iPad, but they are nevertheless significant.
Developers are reporting that apps made using Electron (which is a framework that allows companies to ship web apps in a native app wrapper) are now being rejected by the automated Mac App Store review process.
The apps in question are getting flagged because of their usage of private API calls. These API calls are not in the app itself, but part of the underlying Electron framework.
The detected private API symbols include:
Apparently, the Electron framework has used these APIs for years. What has happened is that Apple has upgraded its server-side app review processes to detect more violations of its App Review guidelines, and now this private API usage is being identified.
Individual Electron app makers are a bit helpless as the issue can only really be fixed by pushing changes in the Electron code itself. It does not appear that Electron is doing anything extreme, certainly nothing malicious. App Review doesn’t care about why an app is using private API, it’s a hard and fast rule (at least in theory).
At a surface level, it seems like it should be relatively straightforward for Electron to remove the API references and use alternative approaches. It’s just that the work hasn’t been done yet which means people depending on Electron are currently in a bind.
The rise in Electron rejections is being interpreted by some as a crackdown against Electron in the wake of the introduction of Apple’s Catalyst framework, which helps developers quickly port native iPad apps to the Mac. It’s a nice conspiracy theory but it doesn’t really make sense. Apple doesn’t really have an incentive, financial or otherwise, to force developers to use Catalyst.
If Mac developers do not want to submit their apps to the App Store, they can publish apps independently. However, as of macOS Catalina, apps must still be notarized using a registered developer account so that they can appease the Gatekeeper security model and are allowed to run on customer’s machines.
Notarization is mostly about making a digital signature of the app so that it cannot be tampered with and can be identified by the system later. It is not a mini app review process so it doesn’t check for things like private API usage.
